4 ms·

IPv6 can be a privacy issue, sure, but it's no less secure, my firewall is still blocking all incoming IPv6 traffic. The issues with IPv6, in my experience com

IPv6 can be a privacy issue, sure, but it's no less secure, my firewall is still blocking all incoming IPv6 traffic. The issues with IPv6, in my experience come from its relative complexity, compared to IPv4, and also from forgetting to manage it at all, as it often uses different tools, firewalls, e.g. ip6tables vs iptables, or the fact that Ubiquiti EdgeRouters don't expose ANY IPv6 firewall configuration in the GUI at all.

posguy 6y ago
Ubiquiti's router offerings are rather poor, VPNs can't roll over to WAN2 automatically, redundant tunnels are hard to configure, IPv6 support is a mess, asking Ubiquiti for support gets you an unhelpful chat that redirects you to help articles you've already read. Other players in this space have had these capabilities for over a decade, and you can call to get help. Ubiquiti might be inexpensive, but its still more than double the price of Grandstream's SoHo/SMB router and access point offerings while offering equivalent support and features. Really neither of these offerings are good outside the SoHo and single location business space. I wish for OpenWRT, OPNsense or WatchGuard's configurability wrapped in a single interface that lets you see the router, switches and access points performance live while letting you alter their settings, without seriously kneecapped router capabilities.
jiggawatts 6y ago
> IPv6 can be a privacy issue Why do people throw this out there as if it's a fact we all agree on? I've heard of one potential privacy issue 20 years ago, which was that IPv6 autoconf used the MAC address for the host part of the address, but this has long since been replaced with regularly rotating random suffixes. So... why keep saying this?
- manigandham 6y ago
  Because the prefix stays the same. And many ISPs that provide IPv6 don’t rotate very often, if at all.
  - Dylan16807 6y ago
    For most ISPs the IPv4 acts exactly the same way, being almost but not quite stable. I don't understand how that's a downside to IPv6.
    - zinekeller 6y ago
      Because "most ISPs" are actually wrong, it's "most American ISPs". In rest of the world, unless you're explicitly requested static IPs, your IPv4 (and IPv6) addresses are being rotated (usually either daily or weekly). There's a reason why dynamic DNS services are popular. P.S. If your security paradigm relies on IP addresses being semi-stable, you need to overhaul it.
      - Dylan16807 6y ago
        >In rest of the world, unless you're explicitly requested static IPs, your IPv4 (and IPv6) addresses are being rotated (usually either daily or weekly). Fair, but that's still IPv4 and IPv6 rotating at the same rate.
      - Hamuko 6y ago
        >In rest of the world, unless you're explicitly requested static IPs, your IPv4 (and IPv6) addresses are being rotated (usually either daily or weekly). I'm in the rest of the world and my non-static IP address almost never changes. I actually memorised my external IP address at one point since I saw it so often.
      - BlueTemplar 6y ago
        This is wrong, at least in Europe, static IP is considered to be best practice.
        BrandoElFollito 6y ago
        I live in France and work in IT and never heard about this "best practice". Who claims that? In use the highest fibre offering from Orange and have a dynamic IP. Fixed IP is for "professionals".
- fomine3 6y ago
  Sadly anyway in theory, dual stack is less secure than single stack, despite whether IPv6 good or bad.
andoriyu 6y ago
IPv6 privacy issue? You know that you get /32 block, you can change your IP from that block every hour if you want. The issue with IPv6 is that links are significantly slower than IPv4 links today. see: https://tools.ietf.org/html/rfc4941 https://tools.ietf.org/html/rfc4941
BlueTemplar 6y ago
No firewall or opt-in firewall (which only a tiny fraction of people turn on) is pretty common for IPv6. It's also somewhat an open question whether router firewalls are even a good idea on IPv6 (since the security advantages are not that certain, and it can prevent the adoption of new protocols).
- detaro 6y ago
  > pretty common for IPv6 Source? Every consumer router I've ever seen that supported IPv6 also had a firewall covering IPv6. Given the crapshot routers tend to be I wouldn't be surprised if some messed that up, but "pretty common" seems unlikely.
  - BlueTemplar 6y ago
    https://lafibre.info/ipv6/ipv6-le-firewall/ https://lafibre.info/ipv6/ipv6-le-firewall/ For context, Free recently boasted reaching 99% IPv6 coverage. On their (now) midrange Freebox Revolution router, the IPv6 firewall is (AFAIK still today) opt-in.
    - detaro 6y ago
      Ugh. Idiots. CPEs should default to firewall on.
      - BlueTemplar 6y ago
        Well, OTOH, the fact that tens of millions of people have now been connected through firewall-free/disabled IPv6 for years, yet the (somewhat expected) disaster of widespread hacking/compromises clearly didn't happen... which could mean that this is not that critical of a security feature as could be expected ?

posguy 6y ago

Ubiquiti's router offerings are rather poor, VPNs can't roll over to WAN2 automatically, redundant tunnels are hard to configure, IPv6 support is a mess, asking Ubiquiti for support gets you an unhelpful chat that redirects you to help articles you've already read. Other players in this space have had these capabilities for over a decade, and you can call to get help. Ubiquiti might be inexpensive, but its still more than double the price of Grandstream's SoHo/SMB router and access point offerings while offering equivalent support and features. Really neither of these offerings are good outside the SoHo and single location business space. I wish for OpenWRT, OPNsense or WatchGuard's configurability wrapped in a single interface that lets you see the router, switches and access points performance live while letting you alter their settings, without seriously kneecapped router capabilities.

jiggawatts 6y ago

> IPv6 can be a privacy issue Why do people throw this out there as if it's a fact we all agree on? I've heard of one potential privacy issue 20 years ago, which was that IPv6 autoconf used the MAC address for the host part of the address, but this has long since been replaced with regularly rotating random suffixes. So... why keep saying this?

manigandham 6y ago
Because the prefix stays the same. And many ISPs that provide IPv6 don’t rotate very often, if at all.
- Dylan16807 6y ago
  For most ISPs the IPv4 acts exactly the same way, being almost but not quite stable. I don't understand how that's a downside to IPv6.
  - zinekeller 6y ago
    Because "most ISPs" are actually wrong, it's "most American ISPs". In rest of the world, unless you're explicitly requested static IPs, your IPv4 (and IPv6) addresses are being rotated (usually either daily or weekly). There's a reason why dynamic DNS services are popular. P.S. If your security paradigm relies on IP addresses being semi-stable, you need to overhaul it.
    - Dylan16807 6y ago
      >In rest of the world, unless you're explicitly requested static IPs, your IPv4 (and IPv6) addresses are being rotated (usually either daily or weekly). Fair, but that's still IPv4 and IPv6 rotating at the same rate.
    - Hamuko 6y ago
      >In rest of the world, unless you're explicitly requested static IPs, your IPv4 (and IPv6) addresses are being rotated (usually either daily or weekly). I'm in the rest of the world and my non-static IP address almost never changes. I actually memorised my external IP address at one point since I saw it so often.
    - BlueTemplar 6y ago
      This is wrong, at least in Europe, static IP is considered to be best practice.
      - BrandoElFollito 6y ago
        I live in France and work in IT and never heard about this "best practice". Who claims that? In use the highest fibre offering from Orange and have a dynamic IP. Fixed IP is for "professionals".
fomine3 6y ago
Sadly anyway in theory, dual stack is less secure than single stack, despite whether IPv6 good or bad.

andoriyu 6y ago

IPv6 privacy issue? You know that you get /32 block, you can change your IP from that block every hour if you want. The issue with IPv6 is that links are significantly slower than IPv4 links today. see: https://tools.ietf.org/html/rfc4941 https://tools.ietf.org/html/rfc4941

BlueTemplar 6y ago

No firewall or opt-in firewall (which only a tiny fraction of people turn on) is pretty common for IPv6. It's also somewhat an open question whether router firewalls are even a good idea on IPv6 (since the security advantages are not that certain, and it can prevent the adoption of new protocols).

detaro 6y ago
> pretty common for IPv6 Source? Every consumer router I've ever seen that supported IPv6 also had a firewall covering IPv6. Given the crapshot routers tend to be I wouldn't be surprised if some messed that up, but "pretty common" seems unlikely.
- BlueTemplar 6y ago
  https://lafibre.info/ipv6/ipv6-le-firewall/ https://lafibre.info/ipv6/ipv6-le-firewall/ For context, Free recently boasted reaching 99% IPv6 coverage. On their (now) midrange Freebox Revolution router, the IPv6 firewall is (AFAIK still today) opt-in.
  - detaro 6y ago
    Ugh. Idiots. CPEs should default to firewall on.
    - BlueTemplar 6y ago
      Well, OTOH, the fact that tens of millions of people have now been connected through firewall-free/disabled IPv6 for years, yet the (somewhat expected) disaster of widespread hacking/compromises clearly didn't happen... which could mean that this is not that critical of a security feature as could be expected ?